Effortless authentication for desktop computers using wrist wearable tokens

Abstract

A system and method for authenticating users of a digital device includes an authentication device attached to an authorized user. The authentication device includes one or more motion sensors and acts as a user identity token. To authenticate with a digital device, the user performs one or more interactions with the digital device using the hand associated with the authentication device. The digital device correlates the inputs received due to the interactions with the user's hand and/or wrist movement, as measured by the authentication device. Access to the digital device is allowed if the inputs and movements are correlated.

What is claimed is: 
     
       1. A method for authenticating an authorized user to a locked digital device, said authorized user wearing an authentication device comprising at least one accelerometer, a digital radio and a processor, the method comprising:
 detecting an intent action performed using an input apparatus of the locked digital device with an arm associated with the authentication device; 
 sending a query to an authentication device in radio proximity of the digital device, said query comprising start and end times of the intent action; 
 receiving data representing authentication device motion extracted from a buffer in the authentication device between the start and end times in the query from the authentication device; 
 correlating the data representing authentication device motion with the detected intent action input; 
 sending a correlation message to the authentication device, the correlation message comprising a success message (M s ), a failure message (M t ) or a retry message (M r ); and 
 receiving an authentication response from the authentication device:
 the authentication response comprising an okay-to-authenticate message (M a ) if the correlation message is the success message (M s ); or 
 
 if the correlation message is the failure message (M f ) or the retry message (M r ), alerting the authorized user to retry the intent action; and 
 unlocking the digital device based on the authentication response. 
 
     
     
       2. The method of  claim 1 , further comprising, after the receiving an authentication response step:
 sending authentication request message (M ack ) to the authentication device. 
 
     
     
       3. The method of  claim 2 , wherein a plurality of authentication devices are located in radio proximity of the digital device and the digital device sends a query to each of the plurality of authentication devices. 
     
     
       4. The method of  claim 1 , wherein correlating the data further comprises generating a set of data points from the data representing authentication device motion. 
     
     
       5. The method of  claim 1 , further comprising:
 establishing a session key when the authentication device is within radio proximity of the digital device, said session key based on a public-key exchange during a pairing of the authentication device with the digital device. 
 
     
     
       6. The method of  claim 1 , further comprising activating the authentication device by associating it with an authorized user. 
     
     
       7. The method of  claim 1 , wherein the input apparatus further comprises a keyboard or mouse. 
     
     
       8. The method of  claim 7 , wherein the intent action further comprises tapping a key multiple times, where the number of times may vary depending on the use case or user preference. 
     
     
       9. The method of  claim 7 , wherein the intent action further comprises moving a mouse through a plurality of direction changes. 
     
     
       10. A system comprising:
 at least one authentication device worn on an arm or wrist of an authorized user, the authentication device comprising:
 at least one accelerometer; 
 a digital radio; and 
 an authentication device processor configured to provide motion data detected by the at least one accelerometer in response to a query message received by the digital radio; and 
 
 at least one digital device comprising at least one digital radio adapted to communicate with the at least one digital radio of the authentication device, at least one input apparatus and at least one digital device processor configured to:
 detect an intent action performed using the at least one input apparatus with an arm associated with the authentication device; 
 send a query to the authentication device, the query comprising an identification and start and end times of the intent action; 
 receive motion data extracted from a buffer in the authentication device between the start and end times in the query from the authentication device; and 
 correlate the intent action and the motion data; 
 
 sending a correlation message to the authentication device, the correlation message comprising a success message (M s ), a failure message (M f ) or a retry message (M r ); and 
 receiving an authentication response from the authentication device:
 the authentication response comprising an okay-to-authenticate message (M a ) if the correlation message is the success message (M s ); or 
 if the response if a failure message (M f ) or a retry message (M r ), alerting the authorized user to retry the intent action; and 
 
 unlocking the digital device based on the authentication response. 
 
     
     
       11. The system of  claim 10 , further comprising a plurality of authentication devices and a plurality of digital devices. 
     
     
       12. The system of  claim 10 , further comprising a plurality of authentication devices and at least one digital device. 
     
     
       13. The system of  claim 10 , wherein the input apparatus further comprises a keyboard or mouse. 
     
     
       14. The system of  claim 13 , wherein an intent action input further comprises tapping a key multiple times, where the number of times may vary depending on the use case or user preference. 
     
     
       15. The system of  claim 13 , wherein the intent action further comprises moving a mouse through a plurality of direction changes. 
     
     
       16. An authentication device for authenticating an authorized user to a locked digital device, said authentication device adapted to be worn by the authorized user and comprising at least one accelerometer, a digital radio and a processor, the processor executing instructions stored in a non-transitory computer readable medium to perform a method comprising:
 receiving a query from the locked digital device, said query comprising start and end times of an intent action performed using an input apparatus of the locked digital device with an arm associated with the authentication device; 
 sending data representing motion of the authentication device between the start and end times in the query to the digital device for correlation with data generated from the input apparatus, further comprising extracting motion data between approximately the start and end times in the query from a buffer in the authentication device and sending the motion data to the digital device; 
 receiving a response from the digital device:
 if the response is a success message (M s ), returning an okay-to-authenticate message (M a ); 
 if the response is a failure message (M f ) or a retry message (M r ), alerting the authorized user to retry the intent action. 
 
 
     
     
       17. The authentication device of  claim 16 , further comprising:
 if the authentication device receives more than one success message (M s ), returning a retry message M r . 
 
     
     
       18. The authentication device of  claim 16 , wherein sending data representing motion further comprises:
 analyzing the motion data to classify it as an intent action identified in the query or some other motion; 
 extracting a set of data points representing the motion data corresponding to the intent action; and 
 sending the set of data points to the digital device. 
 
     
     
       19. The authentication device of  claim 16 , wherein the input apparatus of the locked digital device further comprises a keyboard or mouse. 
     
     
       20. The authentication device of  claim 19 , wherein the intent action further comprises tapping a key multiple times, where the number of times may vary depending on the use case or user preference. 
     
     
       21. The authentication device of  claim 19 , wherein the intent action further comprises moving a mouse through a plurality of direction changes. 
     
     
       22. The authentication device of  claim 16 , wherein the processor further executing instructions to establish a session key when the authentication device is within radio proximity of the locked digital device, said session key based on a public-key exchange during an activation of the authentication device.